topic Advise needed for PIX+Squid Proxy configuration in Network Security

Advise needed for PIX+Squid Proxy configuration

wanghmk1223 — Fri, 21 Feb 2020 08:06:23 GMT

Senario:

Note: Squid proxy at DMZ of PIX (single legged).

Inside LAN: 192.168.22.0 /24

DMZ : 172.16.10.0 /24

How to go ahead to configure PIX acl to forward all http, https, ftp traffic iniated from inside LAN to Internet?

eg.

access-list dmz_in permit tcp host proxy any eq www

access-list dmz_in permit tcp host proxy any eq https

access-list dmz_in permit tcp host proxy any range 20 21

access-list dmz_in permit tcp host proxy eq www 192.168.22.0 255.255.255.0

access-list dmz_in permit tcp host proxy eq https 192.168.22.0 255.255.255.0

access-list dmz_in permit tcp host proxy range 20 21 192.168.22.0 255.255.255.0

access-list inside_in permit tcp 192.168.22.0 255.255.255.0 host proxy eq 8080

Can this config works?

Any expert to help out there?

Re: Advise needed for PIX+Squid Proxy configuration

wanghmk1223 — Tue, 26 Apr 2005 13:28:11 GMT

anyone? help pls?

Re: Advise needed for PIX+Squid Proxy configuration

Patrick Iseli — Tue, 26 Apr 2005 23:09:55 GMT

Look good but you need also DNS !

access-list dmz_in permit udp host proxy any eq 53

access-list dmz_in permit tcp host proxy any eq www

access-list dmz_in permit tcp host proxy any eq https

access-list dmz_in permit tcp host proxy any range 20 21

access-list inside_in deny tcp any any eq www

access-list inside_in deny tcp any any eq https

access-list inside_in deny tcp any any range 20 21

access-list inside_in permit tcp 192.168.22.0 255.255.255.0 host proxy eq 8080

access-list inside_in permit ip any any

This should work ! Reconfigure the Internet Browsers to use the proxy server on port 8080.

Remove this line if the DMZ does not really does establish connections to the inside network.

access-list dmz_in permit tcp host proxy eq www 192.168.22.0 255.255.255.0

access-list dmz_in permit tcp host proxy eq https 192.168.22.0 255.255.255.0

access-list dmz_in permit tcp host proxy range 20 21 192.168.22.0 255.255.255.0

sincerely

Patrick

Re: Advise needed for PIX+Squid Proxy configuration

wanghmk1223 — Wed, 27 Apr 2005 00:33:06 GMT

Thank you so much. Will try and let you know.

Thanks once again.

Re: Advise needed for PIX+Squid Proxy configuration

Patrick Iseli — Wed, 27 Apr 2005 13:52:00 GMT

How did it work ?

sincerely

Patrick

Re: Advise needed for PIX+Squid Proxy configuration

wanghmk1223 — Fri, 29 Apr 2005 00:50:24 GMT

No really. i shd allow LAN (tcp) -> proxy using port 8080 first then applied all deny to http,https,ftp. etc.

Now the problem is the window authentication (win2k3 active directory) at inside LAN whereas proxy is at DMZ.

what ports shd i allow between both to get the proxy auth. works with my win2k3 active directory?

is it only tcp 445 and 88 + udp 88 only ?

anyone can advise?